GHSA-gcg6-xv4f-f749
janino vulnerable to denial of service due to stack overflow
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.codehaus.janino:janino-parent | <= 3.1.9 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
janino 3.1.9 and earlier is subject to denial of service (DOS) attacks when using the expression `evaluator.guess` parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow.
References
External links from the advisory. They lead to third-party sites.